AnyDesk Critical 0-Day Vulnerability Lets Attackers Trigger DoS

Key Takeaways

• A critical zero-day vulnerability (CVE-2026-15682) has been identified in AnyDesk remote desktop software.
• The flaw allows local attackers with low privileges to trigger a denial-of-service (DoS) condition by manipulating file system junctions.
• The vulnerability exploits AnyDesk’s “Send Support Information” feature, leading to arbitrary file writes outside intended locations.
• While a patch is not yet available, organizations should restrict local access and monitor for unusual file system activity.

New AnyDesk Zero-Day Exposes Remote Support Tools to DoS Attacks

A recently disclosed zero-day vulnerability in AnyDesk, identified as CVE-2026-15682, presents a significant operational risk for organizations reliant on the remote desktop solution. This flaw enables local attackers to induce a denial-of-service state by exploiting a core diagnostic function, potentially disrupting critical IT support and access management operations.

Exploiting the “Send Support Information” Feature

The core of the vulnerability lies within AnyDesk’s “Send Support Information” feature, a utility designed to facilitate the sharing of diagnostic data with support personnel during troubleshooting. Attackers can leverage this functionality to manipulate file system operations.

By creating a “junction”—a type of file system reparse point—an attacker can trick the AnyDesk service into writing files to arbitrary locations beyond its designated directory. This unauthorized file writing ultimately leads to a system or application crash, effectively creating a denial-of-service condition and hindering legitimate user access.

A Familiar Pattern of File System Manipulation

This newly uncovered flaw echoes previous security issues within AnyDesk, where similar file system manipulation techniques, such as symbolic links and reparse points, were exploited to bypass security controls during session activities. AnyDesk has grappled with vulnerabilities involving these mechanisms before, including a significant 2024 flaw that utilized wallpaper handling and reparse points to achieve privilege escalation, rather than just service disruption.

According to the Zero Day Initiative advisory, exploiting CVE-2026-15682 requires an attacker to first establish low-privileged code execution on the target machine. This prerequisite means the vulnerability is not remotely exploitable out-of-the-box. While this local access requirement reduces the overall immediate threat compared to fully remote vulnerabilities, it still poses a considerable danger in environments where low-privilege footholds are common, such as shared systems, multi-user setups, or partially compromised networks.

Impact on IT and Managed Services

Denial-of-service vulnerabilities in remote access software are particularly problematic for IT help desks and managed service providers (MSPs) who depend on tools like AnyDesk for uninterrupted remote support. Such disruptions can severely impact service delivery and operational continuity.

Considering AnyDesk’s recent security track record, which includes a 2024 production system breach necessitating certificate revocations and mandatory updates, security teams are strongly advised to address any newly disclosed AnyDesk vulnerability with immediate attention.

What You Should Do

• Monitor for Official Patches: Regularly check AnyDesk’s official security advisories for a patch addressing CVE-2026-15682.
• Restrict Local Access: Implement stringent controls over who can execute low-privileged code on systems running AnyDesk.
• Monitor File System Activity: Until a fix is available, monitor systems for the unusual creation of junctions or reparse points, which could indicate attempted exploitation.
• Review Access Policies: Re-evaluate and strengthen access control policies for all systems where remote desktop software is deployed.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.